2

I am dealing with a unauthenticated identity, via Cognito and the identity pool.

Here is what I am doing (via Rest API calls):

  1. AWSCognitoIdentityService.GetId -- to register the identity
  2. AWSCognitoIdentityService.GetCredentialsForIdentity -- return credentials for the provided identity ID

What I am confused about, is this:

How can I covert the (temporary) AWS Credentials into an Access Token (so that I can perform calls against the AWS API Gateway)?

Or am I thinking about this the wrong way?

Btw, this is what I have, as my AWS Crendetials:

{
  "Credentials": {
    "AccessKeyId": "...",
    "Expiration": 1649299760,
    "SecretKey": "...",
    "SessionToken": "..."
  },
  "IdentityId": "ap-southeast-2:..."
}
Colin Schofield
  • 139
  • 1
  • 13

1 Answers1

0

If your endpoint should work even for unauthenticated users, then just let it without any authorizer.

The Unauthenticated Identity is just a phantom for a user, no one gets authenticated, so you can’t get any authentication token that would guarantee the same.

Floh
  • 745
  • 3
  • 16
  • 1
    Maybe.. I am able to get the Openid Token, via a call to `AWSCognitoIdentityService.GetOpenIdToken`, this returned in JWT formate. This would allow me to perform validation at the server side, but I see your point re a 'phantom' user. – Colin Schofield Apr 23 '22 at 12:29